A race condition exists within the IPv6 routing code of the Linux kernel. When an unregistered network device is being processed for an uncached route, concurrent list manipulation can lead the code to incorrectly hold a reference to the device’s destination topology. The leaked reference keeps the destination entry alive, ultimately resulting in a kernel resource leak. While no privilege escalation or data exposure occurs, repeated leaks could exhaust memory and degrade system availability.

All Linux kernel builds that lack the commit that adds proper locking around uncached IPv6 routes. Distributions running kernels prior to the inclusion of commit 5045aa25f3790dcdb158a58ac60ccf8da42959aa, which contains the race‑condition fix, are affected. Specific release identifiers are not listed in the advisory, so any kernel version without the fix should be considered vulnerable.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation in the wild. The vulnerability is not present in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require a local kernel or driver‑level anomaly that triggers the race between device unregistration and route lookup, making it largely a local, low‑amplitude risk.